Remote-Desktop

Multiple vulnerabilities in FreeRDP allow an attacker to execute arbitrary code, bypass security controls, disclose sensitive information, tamper with data, or cause a denial-of-service, posing a high risk to systems using the software.

A pre-authentication remote code execution vulnerability exists in xrdp versions prior to 0.10.5, triggered by a buffer overflow in the xrdp_wm_parse_domain_information function when parsing a specially crafted domain name, allowing attackers to overwrite the return address and execute arbitrary code.

CVE-2026-32157 is a use-after-free vulnerability in the Remote Desktop Client that allows an unauthorized attacker to execute code over a network.